Keeping a Crowd Safe On the Complexity of Parameterized Verification Javier Esparza Technical University of Munich

Wilfried Brauer ( ) Book of condolence:

„Why don´t you give up?“ Theorem (Alan Turing, 1936) Program termination is undecidable. Theorem (Henry G. Rice, 1961) Every non-trivial property of programs is undecidable. Theorem (Marvin Minsky, 1969) Every non-trivial property of while- programs with two counter variables is undecidable.

„Why don´t you give up?“ Theorem (Alan Turing, 1936) Program termination is undecidable. Theorem (Henry G. Rice, 1961) Every non-trivial property of programs is undecidable. Theorem (Marvin Minsky, 1969) Every non-trivial property of while- programs with two counter variables is undecidable.

„Why don´t you give up?“ Theorem (Alan Turing, 1936) Program termination is undecidable. Theorem (Henry G. Rice, 1961) Every non-trivial property of programs is undecidable. Theorem (Marvin Minsky, 1969) Every non-trivial property of while- programs with two counter variables is undecidable.

Because … Undecidability requires some source of „infinity“: – Variables with an infinite range – Dynamic data structures (lists, trees) – Unbounded recursion Concurrent systems – are difficult to get right, and – often have a finite state space.

Dijkstra´s Mutual Exclusion Algorithm CC CACM 8:9, 1965

Concurrent programs are often finite-state CC

Concurrent programs are often finite-state CC Only two boolean variables per process!

Concurrent programs are difficult to get right CC CACM 9:1, 1966

Concurrent programs are difficult to get right CC

A Leader Election Algorithm (90s)

A Cache-Coherence Protocol (00s) Source: Wikipedia Murphi model checker (Dill et al.)

A Model of a Bluetooth Driver (10s) KISS (Qadeer and Wu)

Parameterized Verification Model-checking tools can only check instances of these systems for particular values of the number N of processes. Can we prove correctness for every N ? Amounts to checking an infinite family of finite- state systems.

Parameterized Verification Model-checking tools can only check instances of these systems for particular values of the number N of processes. Can we prove correctness for every N ? Amounts to checking an infinite family of finite- state systems.

Keeping a Crowd Safe

Parameterized Verification: Give up? Theorem (folklore): The Halting Problem can be reduced to the parameterized coverability problem.

Parameterized Verification: Give up? Theorem (folklore): The Halting Problem can be reduced to the parameterized coverability problem.

Parameterized Verification: Give up? Theorem (folklore): The Halting Problem can be reduced to the parameterized coverability problem. Parameterized verification is doomed!

Identities

Anonymous Crowds We investigate the decidability and complexity of the coverability problem for crowds in which (1)every process executes exactly the same code, (anonymous crowds), and (2)the number of processes is unknown to the processes.

Keeping an Anonymous Crowd Safe

Communication Mechanisms Reliable broadcast – A process sends a message – All other processes receive the message (instantaneously) Rendez-vous – Synchronous exchange of a message between two processes

Communication Mechanisms Reliable broadcast – A process sends a message – All other processes receive the message (instantaneously) Rendez-vous – Synchronous exchange of a message between two processes

Shared memory, no locking  Concurrent reads and writes allowed  Interleaving semantics Communication Mechanisms Shared memory with locking – Processes compete for a lock – Process owning the lock can perform reads and writes

Communication Mechanisms Shared memory with locking – Processes compete for a lock – Process owning the lock can perform reads and writes Shared memory, no locking  Concurrent reads and writes allowed  Interleaving semantics

High or Low Complexity? Verifiers want low complexity

High or Low Complexity? Verifiers want low complexity „ Crowd designers“ (swarm intelligence, population protocols, crowdsourcing) want high complexity

Reliable broadcast Theorem [E., Finkel, Mayr 99] The coverability problem for broadcast protocols is decidable. Informally: Anonymous crowds are not Turing powerful Straightforward application of the backwards reachability algorithm by Abdulla et al., based on the theory of well-quasi-orders.

Reliable broadcast A configuration of the system is completely determined by the number of processes in each state. (No identities)

Reliable broadcast A configuration of the system is completely determined by the number of processes in each state. (No identities)

Reliable broadcast

Love it!

Reliable broadcast: Complexity Theorem (Schmitz and Schnoebelen 13) The coverability problem for broadcast protocols has non-primitive-recursive complexity.

Reliable broadcast: Complexity Theorem (Schmitz and Schnoebelen 2013) The coverability problem for broadcast protocols has non-primitive-recursive complexity.

Reliable broadcast: Complexity Theorem (Schmitz and Schnoebelen 13) The coverability problem for broadcast protocols has non-primitive-recursive complexity. Put that in your pipe and smoke it, Sherlock!

Reliable broadcast: Complexity Theorem (Schmitz and Schnoebelen 13) The coverability problem for broadcast protocols has non-primitive-recursive complexity. G. Delzanno Don‘t despair, Sherlock! Backwards reachability is useful for verification! I‘ve used it to prove properties of a dozen cache-coherence protocols: their templates have under 10 states!

Shared memory with locking Two essential properties of reliable broadcast: (1)Everybody receives every message (2)The crowd can produce a leader Shared memory with locking  Can still produce a leader  Can only guarantee that somebody receives a message

Shared memory with locking Theorem: The coverability problem for systems communicating through a global store with locking is EXSPACE-complete.

Shared memory with locking Lower bound [Lipton 1976]

Shared memory with locking Lower bound [Lipton 1976] Upper bound [Rackoff 1978]:

Shared memory with locking Upper bound [Rackoff 1978]: Unfortunately, for us verifiers this upper bound is algorithmically useless …

Shared memory with locking Theorem [Bozzelli, Ganty 2012]: Symbolic backwards reachability runs in double exponential time for global store with locking.

Shared memory with locking Theorem [Bozzelli, Ganty 2012]: Symbolic backwards reachability runs in double exponential time for global store with locking. Love it! But backwards algorithms often generate too many unreachable states! Cant´t you come up with a forward exploration algorithm?

Shared memory with locking

Don´t love it!

Shared memory with locking

Rendez-Vous Recall: Shared memory with locking  can produce a leader, and  guarantees that somebody receives a message The rendez-vous mechanism  guarantees that somebody receives a message, but  cannot produce a leader

Rendez-Vous

Shared memory without locking Theorem The coverability problem for systems communicating by rendez-vous whose initial configuration has a leader is EXPSPACE-complete.

Shared memory, no locking Locking is difficult to implement and potentially dangerous for many networked systems with dynamic membership – Vehicular networks – Ad-hoc networks

Shared memory, no locking Recall: The rendez-vous mechanism  guarantees that somebody receives a message, but  cannot produce a leader Shared memory without locking  cannot produce a leader and  cannot guarantee that somebody receives a message (overwrites)

Shared memory, no locking Theorem [E.,Ganty, Majumdar 2013, E. 2014] The coverability problem for shared memory without locking and a symmetric initial configuration is polynomial. If the initial configuration has a leader then the problem is NP-complete.

Shared memory, no locking Theorem [E.,Ganty, Majumdar 2013, E. 2014] The coverability problem for shared memory without locking and a symmetric initial configuration is polynomial. If the initial configuration has a leader then the problem is NP-complete. Love it! Piece of cake for our SMT-solvers …

Shared memory without locking Theorem [E.,Ganty, Majumdar 2013] The problem remains NP-complete if the template is a polytime Turing machine

Shared memory without locking Theorem [E.,Ganty, Majumdar 2013] The problem remains NP-complete if the template is a polytime Turing machine Not good! This means we cannot distribute an exponentially long computation onto exponentially many machines so that each machine only does polynomial work.

Summary

Further work and open questions Termination

Further work and open questions Termination Temporal logics

Further work and open questions Termination Temporal logics Implementations

Further work and open questions Termination Temporal logics Implementations And if the processes know N?

That´s all!

Shared memory with locking Theorem [Bozzelli, Ganty 12]: Symbolic backwards reachability runs in double exponential time for global store with locking. Are you ever happy?

A Carry-Look-Ahead 4-Bit-Adder

LeafCell NodeCell RootCell  Circuit

Identities